Read the docs
TI-2020-06435 Aliases CVE-2020-7955GHSA-r9w6-rhh9-7v53

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs…

Priority LOW 27CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

Why it matters now

EPSS 0.01412 72nd percentileScored 2026-11-07
Fix Fixed github.com/hashicorp/consul (Go): 1.6.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/hashicorp/consul (Go)1.4.1 to before 1.6.31.6.3Patch availableGHSA-r9w6-rhh9-7v53
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/hashicorp/consul (Go) Vendor— Affected 1.4.1 to before 1.6.3 Fixed in 1.6.3 Patch available GHSA-r9w6-rhh9-7v53

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*1.4.1 to before 1.6.2VulnerableHashiCorp
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*1.4.1 to before 1.6.2VulnerableHashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:* Versions 1.4.1 to before 1.6.2 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* Versions 1.4.1 to before 1.6.2 Vulnerable ·HashiCorp

Remediation

  • Fix · GHSA-r9w6-rhh9-7v53 github.com/hashicorp/consul (Go) Fixed in 1.6.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • OpenShift Service Mesh 1
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7955
  2. 2026-10-03 Alias added: GHSA-r9w6-rhh9-7v53

References

Advisory 3

Other 1

  • TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
  • TI-2022-11698 HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server… CVSS 3.1HIGH 7.5
  • TI-2021-02215 An issue was discovered in GoGo Protobuf before 1.3.2. CVSS 3.1HIGH 8.6
  • TI-2024-09286 Consul L7 Intentions Vulnerable To Headers Bypass CVSS 3.1HIGH 8.3
  • TI-2023-02638 Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner CVSS 3.1HIGH 8.7
  • TI-2022-03595 Consul Peering Imported Nodes/Services Leak CVSS 3.1HIGH 7.5
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences